San Francisco, April 23 (SocialNews.XYZ) Security researchers at cybersecurity company ZecOps have discovered two vulnerabilities which they believe are widely exploited in the wild to target iPhone and iPad users.
The researchers discovered the bugs in the default iOS and iPadOS Mail app. The bugs allow to run remote code in the context of MobileMail (iOS 12) or maild (iOS 13).
Successful exploitation of this vulnerability would allow the attacker to leak, modify, and delete emails.
"Additional kernel vulnerability would provide full device access -- we suspect that these attackers had another vulnerability. It is currently under investigation," the San Francisco-based ZecOps said on Wednesday.
What is more, on iOS 13, end users do not require to perform any action for the exploitation to succeed. On iOS 12, the bug requires the victim to click on an email.
If an attacker controls the mail server, the attack can be performed without any clicks on iOS 12 too, the researchers said.
Once the vulnerabilities are triggered or exploited, users should not observe any anomalous behaviour besides a temporary slowdown of mobile mail application, the researcher said.
When the exploit fails on iOS 12 -- users may notice a sudden crash of the Mail application.
On iOS13, besides a temporary slowdown, it would not be noticeable. Failed attacks would not be noticeable on iOS 13 if another attack is carried afterwards and deletes the email, they added.
"With very limited data we were able to see that at least six organisations were impacted by this vulnerability - and the potential abuse of this vulnerability is enormous," ZecOps said in a blog post .
iOS is vulnerable to these bugs at least since iOS 6 -September 2012, ZecOps said, adding that it did not check earlier versions.
MacOS is not vulnerable to these bugs, it added.
Following the discovery of the vulnerabilities, ZecOps said it alerted Apple in February.
Apple has patched both the bugs in the latest beta releases of iOS 13, while a fix is set to arrive in the next publicly available iOS update in iOS and iPadOS 13.4.5, reports AppleInsider.
"The newly released beta update of 13.4.5 contains a patch for these vulnerabilities. If you cannot patch to this version instead of using Mail application consider to use other mail applications until a GA patch is available," ZecOps said.
Source: IANS
Gopi Adusumilli is a Programmer. He is the editor of SocialNews.XYZ and President of AGK Fire Inc.
He enjoys designing websites, developing mobile applications and publishing news articles on current events from various authenticated news sources.
When it comes to writing he likes to write about current world politics and Indian Movies. His future plans include developing SocialNews.XYZ into a News website that has no bias or judgment towards any.
He can be reached at gopi@socialnews.xyz
This website uses cookies.
